CVE-2026-96911
7.8HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-59
Impact
A local user with standard account access can elevate privileges to SYSTEM. The attacker must already have local code execution on the Windows host.
Root cause
Improper link resolution (symlink/junction following) before file access in the Windows Search Component allows redirection of privileged file operations.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the relevant Microsoft security update from the MSRC advisory. If patching must wait, stop and disable the Windows Search service (WSearch) to reduce attack surface.
$ powershell -Command "Stop-Service -Name WSearch; Set-Service -Name WSearch -StartupType Disabled"AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.